The approaches described in this section could be pursued, but are not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated herein, the approaches described in this section are not prior art to the claims in this application and are not admitted to be prior art by inclusion in this section.
A botnet is a collection of software agents distributed on networked devices under the control of an originating server. The originating server may belong to a malicious website or network resource that distributes malware such as viruses, spyware or other undesirable software programs. Often the bots, e.g, the software agents, that comprise the botnet are running undetected on compromised computers. For example, the owner of a personal computer may have a bot running on the computer and owner may not know that the bot exists. Moreover, the bot may allow someone other that the owner of the computer to control functions of the computer. For example, the bot may be programmed to send out e-mails, e.g. spam, to other devices. Additionally, the bot may be programmed to propagate computer viruses, make available backdoors, or participate in a denial of service attack on other devices. The botnet controller server may be programmed to coordinate a collection of bots, e.g. the botnet, to perform a denial of service attack, among other malicious activities. Botnets are frequently used for hosting server applications, such as web servers, file servers, application servers and other server types, that are controlled by an originating server and therefore may use fast flux to avoid detection.
Fast flux is a domain name system (DNS) technique used by botnets to hide phishing and malware delivery web-sites behind an ever-changing network of compromised hosts that are acting as proxies for the phishing or malware delivery web-sites. Fast flux can also refer to the combination of peer-to-peer networking, distributed command and control, web-based load balancing and proxy redirection that are used to make malware networks more resistant to discovery by network security mechanisms and the counter-measures employed by network security mechanisms.
There are at least two different types of fast flux techniques: single-flux and double-flux. Single-flux is characterized by multiple individual nodes within the network registering and de-registering their internet protocol (IP) addresses as part of the DNS address (DNS A) record list for a single DNS name. The single-flux variation combines round-robin DNS registration with very short time to live (TTL) values to create a constantly changing list of destination IP addresses for a single DNS name. Double-flux is characterized by multiple nodes within the network registering and de-registering their IP addresses as part of the DNS name server (DNS NS) record list for the DNS zone. Hence, double-flux provides an additional layer of redundancy and survivability within a malware network.
Within a malware attack the DNS records may point to a compromised system, e.g., a bot, that is acting as a proxy for a malicious website. Thus, the DNS records may contain the IP addresses of network devices on which various bots reside that are acting on behalf of the malicious website instead of containing the IP address of the malicious website itself. This technique may prevent some of the traditionally best defense mechanisms from working such as IP address-based access control lists (ACL). Further, the technique may also be used to hide the attacker's systems, which may exploit the network through a series of proxies, e.g. bots, and make it much more difficult to identify the attacker's network. For example, the DNS record may point to an IP address where bots go for registration, to receive instructions, or to activate attacks instead of identifying the IP address of the attacker.